Even "exfiltrated" is not really accurate since it was freely handed over.

The problem is that Facebook just made its partners pinky swear to only use the data for research, which is obviously not an adequate data security measure.